Baton: Key Agility for Android without a Centralized Certificate Infrastructure
نویسندگان
چکیده
Android’s trust-on-first-use application signing model associates developers with a fixed signing key, but lacks a mechanism to transparently update the key or renew their signing certificate. As an advantage, this feature allows application updates to be recognized as authorized by a party with access to the original signing key. Changing keys or certificates requires that end-users manually uninstall/reinstall apps, losing all non-backed up user data. In this paper, we show that with appropriate OS support, developers can securely and without user intervention transfer signing authority to a new signing key. Our proposal, Baton, modifies Android’s app installation framework enabling key agility while preserving backwards compatibility with current apps and current Android releases. Baton is designed to work consistently with current UID sharing and signature permission requirements. We discuss the technical changes made to Android, and remaining open issues such as key loss and signing authority revocation on Android.
منابع مشابه
Mobile Solution for Digital Signature
This article describes a mobile interpretation of the PKI architecture used in document digital signature. The architecture relies on a three-way client-server model which communicates via a combination of Bluetooth and Wireless LAN channels. The idea of implementing such a system using an Android device as the signee is an alternative to the more traditional approach which uses desktop applica...
متن کاملA Self-organized Public-Key Certificate System in P2P network
P2P network is open, anonymous and dynamical in contrast with conventional network. It’s full of dishonesty, deceit, selfishness. It’s necessary to build a robust security infrastructure system. The one important module of security infrastructure is to identify the users in transactions. This paper will propose an identification solution based on PKI. In our algorithm, the peer generates their ...
متن کاملA robust self-organized public key management for mobile ad hoc networks
A mobile ad hoc network MANET is a self-organized wireless network where mobile nodes can communicate with each other without the use of any existing network infrastructure or centralized administration. Trust establishment and management are essential for any security framework of MANETs. However, traditional solutions to key management through accessing trusted authorities or centralized serv...
متن کاملFully Distributed Trust Model based on Trust Graph for Mobile Ad hoc Networks
Amobile ad hoc network (MANET) is a wireless communication network which does not rely on a pre-existing infrastructure or any centralized management. Securing the exchanges in MANETs is compulsory to guarantee a wide spread development of services for this kind of networks. The deployment of any security policy requires the definition of a trust model that defines who trusts who and how. Our w...
متن کاملPOSTER: Android + Open Wi-Fis = Broken SSL?
In previous work [1] we demonstrated severe problems with the way Android applications use SSL. We performed an in-depth study of 13,500 Android apps and discovered that a large number of apps did not use SSL correctly and thus, were vulnerable to Man-In-The-Middle attacks. To make these threats a reality, an attacker needs to execute an active man-in-the-middle attack (MITMA). While MITMAs are...
متن کامل